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DETAILED ACTION 



Preliminary Amendment 

1 . Examiner acknowledges Preliminary Amendment for the claims filed 1 0/3/2005. 
Applicants have cancelled claim 31 to put the claims in proper form for examination. 
The submitted amendments have been entered and made of record. Presently, 
pending claims are 1 - 30. 

Priority 

2. The application is filed on 7/26/2006 but has a 371 case of PCT/EP03/03539 
application filed 4/4/2003. 

Claim Objections 

3. Claim 1 1 is objected to because of the following informalities: "ereated and 
communicated" should be replaced with " created and communicated". 

4. Claim 18 is objected to because of the following informalities: " rotated data 
accessible at the at feast " should be replaced with " related data accessible at the at 
least ". 

Claim Rejections - 35 USC § 101 
35 U.S.C. 101 reads as follows: 



Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 
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5. Claims 28 - 30 are rejected under 35 U.S.C. 101 because these claims are 
directed to " A computer program loadable into the processing unit" , which is merely an 
example of functional descriptive material, (i.e. software per se), and is nonstatutory 
under 35 USC 101 . By not limiting the computer program product to being stored / 
embedded on a computer readable storage medium, there is a lack of the required 
functional and structural interrelationship between the software and the computer 
storage medium that permits the functionality of the software to be realized upon access 
by a processor. This ability is what underlies the ability to provide a practical 
application. Warmerdam, 33 F.3d at 1361, 31 USPQ2d at 1760. In re Sarkar, 588 F.2d 
1330, 1333, 200 USPQ 132, 137 (CCPA 1978). See MPEP § 2106 (IV.B).1(a). Any 
other claims not addressed are rejected by virtue of their dependency. 

6. Claims 12, 19, 22 and 28 - 30 are rejected under 35 U.S.C. 101 because the 
cited claims are adapted to perform a certain function. Examiner notes that claim 
language such as "adapted to (or adaptable)" merely suggests limitations or makes 
limitations optional to a certain extent. In using claim language such as "adapted to (or 
adaptable)" applicant has not required steps to be performed or limited an apparatus to 
a particular structure (see MPEP 2106). Therefore, the cited claims fail to provide an 
invention with a useful, concrete and tangible result. Any other claims not addressed 
are rejected by virtue of their dependency. 
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Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

7. Claims 1 - 30 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Kutaragi et al. (U.S. Patent 2002/0049580), in view of Epstein (U.S. Patent 6,023,510). 

As per claim 1,12, 22, 28 and 30, Kutaragi teaches a method for provision of 
access for a data requesting entity (Kutaragi: Figure 1 / Element 3: security server is 
equivalent to a data requesting entity) to data related to a principal (Kutaragi: Para 
[0039]: client device ID is qualified as a principal), comprising the following steps: 

creating an access granting ticket (Kutaragi: Para [0039]: the access request 
message including the user information is qualified as an access granting ticket) 
comprising: 

(a) an access specification specifying a permission for an access to data related 
to the principal, said data being available at a data providing entity (Kutaragi: Para 
[0039] and Para [0043] Line 11 - 19: (a) the user information included in the access 
request message is qualified as an access specification which determines / specifies 
whether or not the access permission can be granted by the content server (i.e. data 
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providing entity) and (b) the user information need to be pre-registered at by the content 
server), 

(b) a principal identifier representing the principal towards the data providing 
entity (Kutaragi: Para [0039]: device ID is qualified as the principal). 

However, Kutaragi does not disclose expressly encrypting the access granting 
ticket with an encryption key of the data providing entity. 

Epstein teaches encrypting the access granting ticket with an encryption key of 
the data providing entity (Epstein: Column 3 Line 36 - 42 / Line 50 - 51 ). 

It would have been obvious to a person of ordinary skill in the art at the time the 
invention was made to combine the teaching of Epstein within the system of Kutaragi 
because (a) Kutaragi teaches sending an access request message to a content server 
(Kutaragi: Para [0039]), and (b) Epstein teaches the access query / request message is 
better to be encrypted / protected using a content server's public / private key as per 
encryption technique for data protection (Epstein: Column 3 Line 36 - 42 / Line 50 - 
51). 

communicating to the data requesting entity the encrypted access granting ticket 
accompanied by an identifier of the data providing entity (Kutaragi: Figure 1 / Element 2, 
Element 3 & Element 5: the access request message originated from user device must 
go through the security server (i.e. data requesting entity) to reach the content server 
(i.e. the data providing entity) & (Epstein: Column 3 Line 36 - 42 / Line 50 - 51 : (a) the 
access request message is encrypted with content server's public key and (b) content 
server's public key can be considered as an identifier of the data providing entity), 
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communicating from the data requesting entity to the data providing entity a 
request comprising the encrypted access granting ticket (see immediate rationale 
above), 

decrypting the encrypted access granting ticket with a decryption key of the data 
providing entity corresponding to the encryption key (Epstein: Column 3 Line 50 - 51), 

providing to the data requesting entity access to data related to the principal 
identifier according to the access specification (Kutaragi: Para [0039] / Last sentence 
and Para [0043] Line 11 -19). 

As per claim 19 and 29, Kutaragi teaches a data requesting entity comprising: 
a receiving unit for receiving messages and information; a transmission unit for 
sending of messages and information, and a processing unit for processing of 
messages and information (Kutaragi: Figure 1), 

the receiving unit is adapted to receive a first encrypted access granting ticket 
(Kutaragi: Figure 1 / Element 3: security server is equivalent to a data requesting entity) 
for provision of access to first data related to a principal (Kutaragi: Para [0039]: client 
device ID is qualified as a principal), said first data being available at a first data 
providing entity (Kutaragi: Para [0039]: (a) the user information included in the access 
request message is qualified as an access specification which determines / specifies 
whether or not the access permission can be granted by the content server (i.e. data 
providing entity) and (b) the user information need to be pre-registered at by the content 
server). 
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Kutaragi does not disclose expressly the first encrypted access granting ticket 
being accompanied by an identifier of the first data providing entity. 

Epstein teaches the first encrypted access granting ticket being accompanied by 
an identifier of the first data providing entity (Epstein: Column 3 Line 36 - 42 / Line 50 - 
51). 

It would have been obvious to a person of ordinary skill in the art at the time the 
invention was made to combine the teaching of Epstein within the system of Kutaragi 
because (a) Kutaragi teaches sending an access request message to a content server 
(Kutaragi: Para [0039] and Para [0043] Line 11-19), and (b) Epstein teaches the 
access query / request message is better to be encrypted / protected using a content 
server's public / private key as per encryption technique for data protection (Epstein: 
Column 3 Line 36 - 42 / Line 50 - 51 ). 

Epstein in view of Kutaragi teaches to receive a further encrypted access 
granting ticket for provision of access to further data related to the principal, said further 
data being available at a further data providing entity, the further encrypted access 
granting ticket being accompanied by a further identifier of the further data providing 
entity (Kutaragi: Para [0008] Line 13 - 14: the content server requests the user client to 
further resend the user information ), the processing unit is adapted to generate a first 
request comprising: 

the first encrypted access granting ticket and a further request comprising the 
further encrypted access granting ticket and the transmission unit is adapted to send the 
first request to the first data providing entity and the further request to the further data 
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providing entity, and the receiving unit is adapted to receive a first indication for access 
provision to the first data from the first data providing entity and a further indication for 
access provision to the further data from the further data providing entity (Kutaragi: Para 
[0039]: the access request message including the user information is qualified as an 
access granting ticket) & (Epstein: Column 3 Line 36 - 42 / Line 50 - 51 ). 

As per claim 2, 13 and 23, Kutaragi as modified teaches the encrypted access 
granting ticket comprises or is accompanied by verification information and access is 
provided based on an analysis of the verification information (Kutaragi: Para [0039] and 
Para [0043] Line 1 1 - 1 9) & (Epstein: Column 3 Line 36 - 42 / Line 50 - 51 : the 
encrypted access granting ticket comprises verification information as shown above). 

As per claim 3 and 24, Kutaragi as modified teaches the request to the data 
providing entity comprises a specification for requested data related to the principal and 
access is provided according to a matching of the access specification and the 
requested data (Kutaragi: Para [0039] and Para [0043] Line 11-19). 

As per claim 4, 14 and 21 , Kutaragi as modified teaches the access granting 
ticket is created based on a data storage correlating at least two items of a group 
comprising the identifier of the data providing entity, the data related to the principal 
available at the data providing entity, the principal identifier, the encryption key, and the 
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access specification (Kutaragi: Para [0039] and Para [0043] Line 11 - 19) & (Epstein: 
Column 3 Line 36 - 42 / Line 50 - 51). 



As per claim 5 and 15, Kutaragi as modified teaches an indication for the access 
specification is entered into a principal entity to create the access granting ticket 
(Kutaragi: Para [0039] Line 1 - 5: the user / device identity information is entered and 
available at the client device). 



As per claim 6, 16 and 25, Kutaragi as modified teaches the access granting 
ticket further comprises security information and access is provided based on an 
analysis of the security information (Kutaragi: Para [0039] and Para [0043] Line 11 - 19) 
& (Epstein: Column 3 Line 36 - 42 / Line 50 - 51 ). 



As per claim 7, 8 and 17, Kutaragi as modified teaches the encrypted access 
granting ticket is accompanied by public information (Epstein: Column 3 Line 36 - 42 / 
Line 50 - 51 : the encrypted access granting ticket indeed comprises content server's 
public key information ) & (Kutaragi: Para [0039] and Para [0043] Line 11-19). 



As per claim 9 and 26, Kutaragi as modified teaches the decryption is based on 
an analysis of the public information (Epstein: Column 3 Line 36 - 42 / Line 50 - 51 : the 
decryption of the access granting ticket is based upon content server's public key 
information ). 
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As per claim 10 and 27, Kutaragi as modified teaches the data to which access is 
provided to is transferred to the data requesting entity (Kutaragi: Figure 1 / Element 15- 
1 , 2 & 3: access data is transferred to a security server -- i.e., the data requesting 
entity). 

As per claim 1 1 and 18, Kutaragi as modified teaches at least one further 
encrypted-access granting ticket for further data related to the principal available at 
least one further data providing entity is ereated and communicated to the data 
requesting entity for provision of access to the further principal related data available at 
the at least one further data providing entity, the at least one further encrypted access 
granting ticket being accompanied by at least one further identifier of the at least one 
further data providing entity (Kutaragi: Para [0039], Para [0043] Line 11 - 19 and Para 
[0008] Line 13 - 14: the content server requests the user client to further resend the 
user information ) & (Epstein: Column 3 Line 36 - 42 / Line 50 - 51 ). 

As per claim 20, Kutaragi as modified teaches at least one of the first encrypted 
access granting ticket and the further encrypted access granting ticket is accompanied 
by public information and the processing unit is adapted to analyze the public 
information before the generation of at least one of the first request and the further 
request (Epstein: Column 3 Line 36 - 42 / Line 50 - 51 : (a) encrypted access granting 
ticket comprises public information such as content server's public key information (b) 
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the generation of the encryption for the request represented by encrypted access 
granting ticket must analyze the content server's public key information first prior to 
using its public key for encryption). 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to LONGBIT CHAI whose telephone number is (571 )272- 
3788. The examiner can normally be reached on Monday-Friday 9:00am-5:00pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz R. Sheikh can be reached on 571-272-3795. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/Longbit Chai/ 

Longbit Chai Ph.D. 
Primary Patent Examiner 
Art Unit 2431 
7/15/2008 



